From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
To: netfilter-devel@vger.kernel.org, pablo@netfilter.org, fw@strlen.de
Cc: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Subject: [PATCH nf-next] netfilter: nf_defrag_ipv4: Skip defrag if NOTRACK is set
Date: Mon, 13 Nov 2017 18:37:26 -0700 [thread overview]
Message-ID: <1510623446-9115-1-git-send-email-subashab@codeaurora.org> (raw)
conntrack defrag is needed only if some module like CONNTRACK or NAT
explicitly requests it. For plain forwarding scenarios, defrag is
not needed and can be skipped if NOTRACK is set in a rule.
Since conntrack defrag is currently higher priority than raw table,
setting NOTRACK is not sufficient. We need to introduce a lower
priority rule and deprecate the existing rule.
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
---
include/uapi/linux/netfilter_ipv4.h | 3 ++-
net/ipv4/netfilter/nf_defrag_ipv4.c | 6 +++---
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/include/uapi/linux/netfilter_ipv4.h b/include/uapi/linux/netfilter_ipv4.h
index e6b1a84..cedf7b4 100644
--- a/include/uapi/linux/netfilter_ipv4.h
+++ b/include/uapi/linux/netfilter_ipv4.h
@@ -57,9 +57,10 @@
enum nf_ip_hook_priorities {
NF_IP_PRI_FIRST = INT_MIN,
- NF_IP_PRI_CONNTRACK_DEFRAG = -400,
+ NF_IP_PRI_CONNTRACK_DEFRAG = -400, /* deprecated */
NF_IP_PRI_RAW = -300,
NF_IP_PRI_SELINUX_FIRST = -225,
+ NF_IP_PRI_CONNTRACK_DEFRAG_V1 = -210,
NF_IP_PRI_CONNTRACK = -200,
NF_IP_PRI_MANGLE = -150,
NF_IP_PRI_NAT_DST = -100,
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index 37fe1616..6496890 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -80,7 +80,7 @@ static unsigned int ipv4_conntrack_defrag(void *priv,
#endif
#endif
/* Gather fragments. */
- if (ip_is_fragment(ip_hdr(skb))) {
+ if (skb->_nfct != IP_CT_UNTRACKED && ip_is_fragment(ip_hdr(skb))) {
enum ip_defrag_users user =
nf_ct_defrag_user(state->hook, skb);
@@ -95,13 +95,13 @@ static unsigned int ipv4_conntrack_defrag(void *priv,
.hook = ipv4_conntrack_defrag,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_PRE_ROUTING,
- .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG_V1,
},
{
.hook = ipv4_conntrack_defrag,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT,
- .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
+ .priority = NF_IP_PRI_CONNTRACK_DEFRAG_V1,
},
};
--
1.9.1
next reply other threads:[~2017-11-14 1:37 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-14 1:37 Subash Abhinov Kasiviswanathan [this message]
2017-12-09 15:10 ` [PATCH nf-next] netfilter: nf_defrag_ipv4: Skip defrag if NOTRACK is set Pablo Neira Ayuso
2017-12-10 2:06 ` Subash Abhinov Kasiviswanathan
2017-12-10 14:53 ` Pablo Neira Ayuso
2017-12-11 7:13 ` Subash Abhinov Kasiviswanathan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1510623446-9115-1-git-send-email-subashab@codeaurora.org \
--to=subashab@codeaurora.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.